| sigma |
F5 BIG-IP iControl Rest API Command Execution - Webserver |
test |
2023-11-08 |
| snort |
ET TROJAN Socks5SystemZ CnC Checkin Response M2 |
rev 1 |
2023-11-07 |
| snort |
ET TROJAN Socks5SystemZ CnC Checkin Response M1 |
rev 1 |
2023-11-07 |
| suricata |
ET MALWARE Socks5SystemZ CnC Checkin Response M1 |
rev 1 |
2023-11-07 |
| suricata |
ET MALWARE Socks5SystemZ CnC Checkin Response M2 |
rev 1 |
2023-11-07 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected M1 Version 1.x-6.x |
rev 1 |
2023-11-06 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected M2 Version 1.x-6.x |
rev 1 |
2023-11-06 |
| suricata |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected M2 Version 1.x-6.x |
rev 1 |
2023-11-06 |
| suricata |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected M1 Version 1.x-6.x |
rev 1 |
2023-11-06 |
| sigma |
HackTool - CrackMapExec Execution Patterns |
stable |
2023-11-06 |
| snort |
ET WEB_SERVER Tunna Variant Webshell Activity |
rev 2 |
2023-11-03 |
| snort |
ET CURRENT_EVENTS SWAT USA Drop Login Panel |
rev 1 |
2023-11-03 |
| suricata |
ET WEB_SERVER Tunna Variant Webshell Activity |
rev 2 |
2023-11-03 |
| sigma |
Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback |
test |
2023-11-03 |
| snort |
ET TROJAN Suspected APT34 Related SSD Backdoor Response |
rev 1 |
2023-11-02 |
| elastic |
Deprecated - Potential Reverse Shell via Suspicious Parent Process |
deprecated |
2023-11-02 |
| snort |
ET TROJAN SockRacket/KANDYKORN CnC Response |
rev 1 |
2023-11-01 |
| snort |
ET TROJAN SockRacket/KANDYKORN Client Challenge |
rev 1 |
2023-11-01 |
| snort |
ET TROJAN GCleaner Downloader Activity M11 |
rev 1 |
2023-11-01 |
| snort |
ET TROJAN GCleaner Downloader IP Address Retrieval Attempt M2 |
rev 1 |
2023-11-01 |
| suricata |
ET MALWARE GCleaner Downloader IP Address Retrieval Attempt M2 |
rev 1 |
2023-11-01 |
| suricata |
ET MALWARE GCleaner Downloader Activity M11 |
rev 1 |
2023-11-01 |
| suricata |
ET MALWARE SockRacket/KANDYKORN CnC Response |
rev 1 |
2023-11-01 |
| suricata |
ET MALWARE SockRacket/KANDYKORN Client Challenge |
rev 1 |
2023-11-01 |
| snort |
ET TROJAN Base64 Encoded MZ In Image |
rev 1 |
2023-10-31 |
| suricata |
ET MALWARE Base64 Encoded MZ In Image |
rev 1 |
2023-10-31 |
| snort |
ET TROJAN Suspected Bumblebee Loader Activity |
rev 1 |
2023-10-30 |
| snort |
ET TROJAN Possible Konni RAT Related Activity Observed |
rev 1 |
2023-10-30 |
| suricata |
ET MALWARE Possible Konni RAT Related Activity Observed |
rev 1 |
2023-10-30 |
| sigma |
Potential Information Disclosure CVE-2023-43261 Exploitation - Web |
test |
2023-10-30 |
| sigma |
Potential Information Disclosure CVE-2023-43261 Exploitation - Proxy |
test |
2023-10-30 |
| sigma |
Suspicious Unsigned Thor Scanner Execution |
stable |
2023-10-29 |
| sigma |
AWS S3 Bucket Versioning Disable |
test |
2023-10-28 |
| snort |
ET TROJAN Win32/NewsRat CnC Response |
rev 1 |
2023-10-27 |
| suricata |
ET MALWARE Win32/NewsRat CnC Response |
rev 1 |
2023-10-27 |
| sigma |
Delete Volume Shadow Copies Via WMI With PowerShell |
stable |
2023-10-27 |
| sigma |
PowerShell Called from an Executable Version Mismatch |
test |
2023-10-27 |
| sigma |
Netcat The Powershell Version |
test |
2023-10-27 |
| sigma |
Use Get-NetTCPConnection |
test |
2023-10-27 |
| sigma |
PowerShell Downgrade Attack - PowerShell |
test |
2023-10-27 |